GHSA-9f24-jqhm-jfcw

fetch(url) leads to a memory leak in undici

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-24750

Packages

Ecosystem	Package	Affected	Fixed in
npm	undici	>= 6.0.0, < 6.6.1	6.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. ### Patches Patched in v6.6.1 ### Workarounds Make sure to always consume the incoming body.

References

External links from the advisory. They lead to third-party sites.

https://github.com/nodejs/undici/security/advisories/GHSA-9f24-jqhm-jfcw web
https://nvd.nist.gov/vuln/detail/CVE-2024-24750 advisory
https://github.com/nodejs/undici/commit/87a48113f1f68f60aa09abb07276d7c35467c663 web
https://github.com/nodejs/undici package
https://github.com/nodejs/undici/releases/tag/v6.6.1 web
https://security.netapp.com/advisory/ntap-20240419-0006 web